Principal Software Engineer - Infrastructure Platform

Procore Technologies is seeking a Principal Software Engineer to lead the architecture and engineering of its FedRAMP platform. The role builds and governs compliant infrastructure provisioning systems, applies infrastructure-as-code and AI-driven automation, and establishes reliability and compliance practices across the authorization boundary.

Responsibilities

• Own infrastructure as code for the boundary: Define the architecture, module standards, and delivery workflow for all FedRAMP infrastructure in Terraform (or similar), and drive the platform toward fully codified, reviewed, and automatically deployed infrastructure
• Design provisioning and organization: Architect how cloud accounts, organizational units, networks, Kubernetes clusters, and environments are structured and provisioned inside the authorization boundary, including landing zones, guardrails, and account vending, so that new workloads land compliant by default
• Build the provisioning platform: Write production software (Go, Python, or TypeScript) for the controllers, pipelines, and internal tooling that turn infrastructure requests into reviewed, policy-checked, automatically applied changes
• Apply AI to infrastructure: Use AI-assisted development tooling daily, and build AI-driven automation into the platform: agents that draft and validate IaC changes against policy, generate compliance evidence from infrastructure state, and detect and remediate drift
• Set technical direction: Own the multi-year platform architecture, write and review design documents, make build-versus-buy decisions, and align engineering, security, and compliance stakeholders on the roadmap
• Engineer for compliance: Translate FedRAMP controls (NIST SP 800-53) for configuration management, change control, and boundary protection into policy-as-code and automated evidence, and partner with security on continuous monitoring (ConMon) and annual assessment readiness
• Run the platform like an SRE: Establish reliability standards, SLOs, and incident practices for the provisioning layer, and lead the response when the foundation itself has problems
• Lead and multiply: Mentor Staff and Senior engineers, lead cross-team migrations onto the standard platform, and act as the final technical authority for infrastructure decisions inside the boundary

Skills

• This position requires US citizenship to work on FedRAMP-compliant projects
• Candidates must be eligible to work on federal government projects requiring FedRAMP authorization
• 12+ years of software, infrastructure, or site reliability engineering experience, including at least 3 years operating within a FedRAMP-authorized or similarly regulated environment, with hands-on AWS GovCloud experience
• Deep, hands-on expertise designing and scaling Terraform (or similar) across many accounts and environments: module design, state management, policy-as-code (e.g., OPA, Sentinel, Checkov), and GitOps-based delivery
• Proven experience designing multi-account cloud organizations, landing zones, account vending, network topology, and IAM boundaries at scale, and an understanding of how those choices map to compliance controls
• Strong programming fundamentals and a track record of shipping production software in Go, Python, or TypeScript, including internal platforms and developer tooling used by other engineers
• Extensive experience architecting, provisioning, and hardening Kubernetes clusters as code, including policy enforcement (e.g., OPA/Gatekeeper, Kyverno) and secrets management
• A history of setting architecture direction for a platform organization, writing design documents that others build from, and influencing without authority across engineering, security, and compliance
• Experience owning reliability for foundational infrastructure, including incident command, postmortems, and systematic toil reduction
• Comfort using AI-assisted development tools in daily work, and a point of view on how AI should be applied to infrastructure automation
• Experience with cloud traffic, service mesh, and observability tooling (Istio, Kong, Cloudflare, Datadog)
• Experience with IAM architecture (Okta, SAML/OIDC, zero-trust) and FIPS 140-2/140-3 validated cryptography in practice
• Experience with secrets management platforms operating in FIPS mode (e.g., HashiCorp Vault)
• Familiarity with FedRAMP Rev 5 requirements, STIG application, or CIS benchmark enforcement at scale
• Experience building AI agents or ML-driven automation for infrastructure (AIOps)
• Certifications such as HashiCorp Terraform Authoring and Operations Professional, AWS Solutions Architect - Professional, CKA/CKS, or CISSP

Benefits

• This role may also be eligible for Equity Compensation.
• This role may also be eligible for Bonus Incentive Compensation.
• Hybrid role based out of our Austin, TX office; consideration will be made for this role to be based in Carpinteria, the Bay Area, or NYC.

Company Overview